A critical out-of-bounds read vulnerability in the HTSlib bioinformatics library allows unauthenticated remote attackers to potentially leak memory contents or crash applications.

This flaw involves an improper validation of the reference ID field in the cram_decode_slice function, which occurs too late in the processing of CRAM records. An unauthenticated attacker can trigger this via a specially crafted CRAM file, resulting in out-of-bounds memory reads.

The vulnerability carries a CVSS score of 8.2, classifying it as High severity. Successful exploitation could lead to the unauthorized disclosure of sensitive bioinformatics data or cause significant service disruption through application crashes. Organizations relying on HTSlib for high-throughput sequencing analysis are at risk of data integrity compromise and operational downtime.

Immediate Action: Update HTSlib to version 1.21.1, 1.22.2, 1.23.1, or later to incorporate the necessary input validation patches.

Proactive Monitoring: Monitor bioinformatics processing pipelines for unexpected segmentation faults, process crashes, or abnormal memory usage patterns during CRAM file ingestion.

Compensating Controls: Since no workarounds exist, ensure that only trusted or validated CRAM files are ingested into processing environments. Implement strict input sanitization at the application layer where possible.

Public Exploit Available: No (exploit_available: false).

Given the potential for information leakage and service disruption, administrators should prioritize updating to the fixed versions of HTSlib immediately. Because the vulnerability is triggered during the processing of CRAM files, any system or service that parses untrusted bioinformatics data must be considered high-risk until the patch is applied.